2. Evaluate Session Manager Configuration

To begin our evaluation, we need to examine the default configuration and behavior of Session Manager and determine what is needed to meet the requirements given to us for this project.

Evaluate cross-platform behavior, security context and default privilege levels

  1. Under Instances & Nodes in the AWS Systems Manager navigation menu, browse to the Managed Instances console.
  2. Select the session-manager-linux-prod instance, click Actions, click Start Session.
  3. Now that we have established an interactive shell to the instance, let’s determine our user context on the instance and evaluate our privilege level. Click into the Session Manager Console to be able to enter commands below:
    • Execute whoami to determine what user context we’re running under.
    • Execute sudo su followed by cat /etc/sudoers.d/ssm-agent-users to evaluate the privilege level assigned to the user ssm-user.
  4. AWS Systems Manager works by having the SSM agent on the instance establish an outbound session to the Systems Manager service.
    • Execute netstat -nputw | grep -i ssm to validate this behavior and verify communications are actually being sent over a secure channel.
  5. Click Terminate to terminate the session or type exit and select close .
  6. Select the session-manager-windows-prod instance, click Actions, click Start Session.
  7. Since this is a Windows instance, notice we’ve established an interactive PowerShell session.
    • Execute whoami to determine what user context we’re running under.
    • Execute net user ssm-user to determine the local group memberships assigned to the local user ssm-user.
  8. Click Terminate to terminate the session or type exit and select close.

Evaluate the default auditing and logging configuration for Session Manager

  1. Under Instances & Nodes in the AWS Systems Manager navigation menu, browse to the Session Manager console.
  2. Select the Session history tab and review the session history details available. Note: that no information is presented under the Output location field.

Evaluate the port requirements and default permissions of managed IAM policies

  1. Browse to the EC2 Instances console
  2. Click on any instance with its name starting with “session-manager".

  1. In the pane to the bottom right under the Description pane, click on the session-manager-demo Security Group.

  1. Select the Inbound rules and Outbounds rules tab to evaluate the Security Group rules. You should notice that no inbound ports have been authorized and all outbound traffic is authorized.

  1. Lets now review the permissions granted by the managed IAM policy. Browse to the IAM console and under Policies click on AmazonSSMManagedInstanceCore. Note the permissions granted as shown in the image below.

    This managed policy is attached to the session-manager-demo-default IAM role currently associated with our managed instances which can be seen under the Policy usage tab.

Stuck? Watch this

This video has no audio